package controller

import (
	"context"
	"strings"
	"testing"

	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime"
	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
	"sigs.k8s.io/controller-runtime/pkg/client"
	"sigs.k8s.io/controller-runtime/pkg/client/fake"

	bindv1alpha1 "git.unkin.net/unkin/bind-operator/api/v1alpha1"
)

// TestRenderedConfigIndependentOfPrimaryPodIP guards the v0.2.5 loop: if a pod
// IP leaks into named.conf, every pod churn re-renders config and reconfigs every
// pod. Render with the primary pod on two different IPs and require identical
// output.
func TestRenderedConfigIndependentOfPrimaryPodIP(t *testing.T) {
	scheme := runtime.NewScheme()
	if err := clientgoscheme.AddToScheme(scheme); err != nil {
		t.Fatal(err)
	}
	if err := bindv1alpha1.AddToScheme(scheme); err != nil {
		t.Fatal(err)
	}

	const ns = "dns"
	svcIP := "10.43.5.5" // stable primary Service ClusterIP (does NOT churn)

	cluster := &bindv1alpha1.BindCluster{
		ObjectMeta: metav1.ObjectMeta{Name: "auth", Namespace: ns},
		Spec: bindv1alpha1.BindClusterSpec{
			Mode:           bindv1alpha1.ModeAuthoritative,
			Replicas:       3,
			PrimaryService: &bindv1alpha1.ClusterServiceSpec{},
		},
	}
	primarySvc := &corev1.Service{
		ObjectMeta: metav1.ObjectMeta{Name: primaryServiceName(cluster.Name), Namespace: ns},
		Spec:       corev1.ServiceSpec{ClusterIP: svcIP},
	}
	catalog := &bindv1alpha1.BindCatalogZone{
		ObjectMeta: metav1.ObjectMeta{Name: "cat", Namespace: ns},
		Spec: bindv1alpha1.BindCatalogZoneSpec{
			ClusterRef:     cluster.Name,
			ZoneName:       "catalog.internal",
			TransferKeyRef: "externaldns-key",
		},
	}
	tsig := &bindv1alpha1.BindTSIGKey{
		ObjectMeta: metav1.ObjectMeta{Name: "externaldns-key", Namespace: ns},
		Spec:       bindv1alpha1.BindTSIGKeySpec{ClusterRef: cluster.Name},
	}

	renderWithPrimaryIP := func(ip string) string {
		primaryPod := &corev1.Pod{
			ObjectMeta: metav1.ObjectMeta{Name: primaryPodName(cluster.Name), Namespace: ns, Labels: commonLabels(cluster.Name)},
			Status:     corev1.PodStatus{PodIP: ip},
		}
		c := fake.NewClientBuilder().
			WithScheme(scheme).
			WithObjects(cluster, primarySvc, catalog, tsig, primaryPod).
			Build()
		r := &BindClusterReconciler{Client: c, Scheme: scheme}
		ctx := context.Background()
		primaryConf, secondaryConf, err := r.reconcileConfigMap(ctx, cluster)
		if err != nil {
			t.Fatalf("reconcileConfigMap: %v", err)
		}
		// Sanity: the pod IP must not have leaked into the rendered config.
		var cm corev1.ConfigMap
		if err := c.Get(ctx, client.ObjectKey{Namespace: ns, Name: configMapName(cluster.Name)}, &cm); err != nil {
			t.Fatalf("get configmap: %v", err)
		}
		for k, v := range cm.Data {
			if ip != "" && strings.Contains(v, ip) {
				t.Fatalf("primary pod IP %s leaked into rendered config %s:\n%s", ip, k, v)
			}
		}
		return primaryConf + secondaryConf
	}

	h1 := renderWithPrimaryIP("10.42.3.197")
	h2 := renderWithPrimaryIP("10.42.9.42") // primary pod restarted onto a new IP
	if h1 == "" {
		t.Fatal("rendered config should not be empty")
	}
	if h1 != h2 {
		t.Fatalf("rendered config changed when only the primary pod IP changed — the v0.2.5 loop:\n%s\n%s", h1, h2)
	}
}